HostLoom 0.15.0

The fifteenth release of HostLoom. One thread runs through it, and it is a new package: secure generators for the values a service hands to people, such as confirmation codes, coupon codes, invoice identifiers, order IDs, tokens, and nonces.

HostLoom.Generators is dependency-free (pure BCL) and trimming- and Native AOT-compatible, and it collects the string and code generators a service otherwise hand-rolls, where the usual defects are subtle: modulo bias in character picking, off-by-one bounds, formatting that depends on the current culture, and codes that do not survive their own normalisation. It provides exact-length random strings over versioned preset alphabets (Digits, HexLower, HexUpper, AlphaNumeric, UrlSafe, and a thirty-one-character HumanReadable that drops the visually ambiguous glyphs); fixed-width numeric codes that keep their leading zeros, with a legacy maxExclusive adapter and a NumericIdProfile for identifiers that never start with zero; human-readable coupon codes with position-aware check digits and a Normalize/TryValidate pair where a generated code always survives validation of its normalized form; opaque Base64Url tokens and hex nonces; exact-length prefixed identifiers that reject an unacceptable prefix rather than sanitize it; dashed and compact GUID string identifiers; DistinctBatch for batch-local de-duplication after canonicalization; and SecureChoice for unbiased choice. Every generator draws from a cryptographic random number generator behind the explicit IRandomSource entropy seam, so a test can substitute deterministic entropy instead of reaching into production randomness.

The guarantees are stated as narrowly as the implementation. No generator promises uniqueness: two calls can return the same value, durable uniqueness stays an atomic constraint in the owning service, and DistinctBatch de-duplicates only within one batch. Generated secrets must never be logged, and the package's own Native AOT sample prints lengths rather than values. Output formatting uses the invariant culture only. And this is not a drop-in Powell.CouponCode replacement: the pinned 1.0.3 artifact's alphabet, checksums, and grouping behavior are unverified, and old codes are never regenerated. The companion HostLoom.Generators.Testing package ships the deterministic fakes of the seam — SeededRandomSource for repeatable shapes, ScriptedRandomSource, which forces exact draws and fails loudly when under-scripted, and AsyncNumericSequence — with no dependency on a test framework.

Upgrading from 0.14.0 changes nothing an application already references: no existing package changes.

HostLoom.Generators and HostLoom.Generators.Testing are published for the first time; the rest of the set is unchanged. @hostloom/websocket-client is not part of this NuGet set; that package carries its own version and ships when a websocket-client-vX.Y.Z tag is published, and it has no changes since its 0.3.0 release.

Added

• HostLoom.Generators, secure random strings, numeric codes, coupon codes, opaque tokens, and constrained identifier generators, and HostLoom.Generators.Testing, the deterministic IRandomSource fakes for tests.